Debian 11: DLA-4352-1 python-authlib Important Security Threats

Multiple vulnerabilities have been found in python-authlib, a Python
library for OAuth and OpenID Connect servers.

CVE-2024-37568

Unless an algorithm is specified in a jwt.decode call, HMAC verification
is allowed with any asymmetric public key.

CVE-2025-59420

Authlib’s JWS verification accepts tokens that declare unknown critical
header parameters (crit), violating RFC 7515 “must‑understand” semantics.
An attacker can craft a signed token with a critical header that strict
verifiers reject but Authlib accepts. In mixed‑language fleets, this
enables split‑brain verification and can lead to policy bypass, replay,
or privilege escalation.

CVE-2025-61920

Authlib’s JOSE implementation accepts unbounded JWS/JWT header and
signature segments which can lead to a DoS during verification.

CVE-2025-62706

Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression
which can lead to a DoS.